In Camaleon CMS application, versions 0.0.1 to 2.6.0 are vulnerable to stored XSS, that allows an unauthenticated attacker to store malicious scripts in the comments section of the post. These scripts are executed in a victim’s browser when they open the page containing the malicious comment.
References
| Link | Resource |
|---|---|
| https://github.com/owen2345/camaleon-cms/commit/05506e9087bb05282c0bae6ccfe0283d0332ab3c | Patch Third Party Advisory |
| https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25969 | Third Party Advisory |
Configurations
History
29 Nov 2021, 17:22
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : 4.3
v3 : 6.1 |
26 Nov 2021, 14:15
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | In Camaleon CMS application, versions 0.0.1 to 2.6.0 are vulnerable to stored XSS, that allows an unauthenticated attacker to store malicious scripts in the comments section of the post. These scripts are executed in a victim’s browser when they open the page containing the malicious comment. |
25 Oct 2021, 19:21
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-79 | |
| CPE | cpe:2.3:a:tuzitio:camaleon_cms:*:*:*:*:*:*:*:* | |
| References | (MISC) https://github.com/owen2345/camaleon-cms/commit/05506e9087bb05282c0bae6ccfe0283d0332ab3c - Patch, Third Party Advisory | |
| References | (MISC) https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25969 - Third Party Advisory | |
| CVSS |
v2 : v3 : |
v2 : 3.5
v3 : 5.4 |
20 Oct 2021, 12:33
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2021-10-20 12:15
Updated : 2024-02-04 22:08
NVD link : CVE-2021-25969
Mitre link : CVE-2021-25969
CVE.ORG link : CVE-2021-25969
JSON object : View
Products Affected
tuzitio
- camaleon_cms
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')